feat: detect webxdc by application/webxdc+zip MIME type

This is simpler and can count as hardening
because we don't call async_zip parser anymore
just to check if received file is a webxdc.
This way if ZIP parser is buggy and e.g. panics,
or gets into infinite loop, or is accidentally quadratic,
or allocates a lot of memory, this cannot be triggered
by just sending a file.
This commit is contained in:
link2xt
2026-10-13 03:26:50 +00:00
parent d766641ce2
commit 4e2ee61478
5 changed files with 61 additions and 128 deletions
@@ -10,9 +10,8 @@ Content-Type: multipart/mixed; boundary="==BREAK=="
--==BREAK==
Content-Type: text/plain; charset=utf-8
webxdc with good extension;
the mimetype is ignored then,
content is checked.
webxdc with bad mime type,
not detected as a webxdc
--==BREAK==
Content-Type: text/html